I like to stick the hmac hash at the beginning of the cookie text, since it has a known length. I don't care about tampering on the client-side (since you could achieve the same effect with firebug), so js scripts can simply lop off the first n characters and use the rest of the cookie text as-is.