Deny script access to cookies regardless of scheme