always allow writing web cookie, regardless of permissions