adding rule for http only cookies