Manually bypass tough-cookie security warning

NOTE: this is only committed to 0.19.x. If it looks OK, we can merge into all branches. Otherwise, we can back out.

Auditors: @evq, @diracdeltas

.nsprc

@@ -1,3 +1,3 @@
 {
-  "exceptions": ["https://nodesecurity.io/advisories/77"]
+  "exceptions": ["https://nodesecurity.io/advisories/77", "https://nodesecurity.io/advisories/525"]
 }