get_all_user_settings() which is used by get_user_setting now checks that user is logged in - ie get_current_user_id is non-zero - before returning anything. The single line change that makes the difference is that pre-3.7:
if ( ! $user = wp_get_current_user() )
was changed in 3.7 to:
if ( ! $user_id = get_current_user_id() )
This is a bit of a bummer as it was handy to use all the cookie stuff in utils.js before.
The workaround for me was just to copy the pre-3.7 version into my own code.