changed rule order to query string, cookie then rule