The name of the cookie seems to be fixed, while other components (Antiforgery, Session, ...) are open for alternatives. Making this configurable seems to be a breaking change, since there is already a public static property exposing that fixed value, though.

Is there any reason why this is "hard-coded"? Can we make it configurable instead?

I could prepare a PR for that.