Sometimes storing session data serverside is clunky, particularly when you have multiple servers; a classic, reasonable approach in that case is to MAC the contents of the cookie with a 256-bit random key, and then AES-CBC encrypt the cookie with that same key. But I agree, for this app, there's no reason there should be structured data in a cookie.

As for the room IDs --- randomizing them is a fine bit of rubber-chicken security. I think it's a good idea. But the right solution is to allow users to erase the chat logs, and to verify that users have access to a given room before dumping all messages starting at message ID 0.