allow plain cookies (not signed)