Related to performing randomization:

Would it be helpful to set a random-length 'noise' cookie on every request? That could be done at the proxy level, rather than the application level.

It might still be possible to extract secrets by making many requests for each string and performing statistical analysis, but it would change the attack from 30 seconds to several hours, in which time the victim may well have left the attacker's website.