Currently rfc2109 is using the out of date tarball located: http://common-lisp.net/project/rfc2109/release/rfc2109-latest.tar.gz
It should instead use: the darcs repo at http://www.common-lisp.net/project/rfc2109/rfc2109/
For documentation sake, this is important as the tarball outputs invalid (for IE) cookies by default and the darcs repo outputs valid cookie strings.