cookie pass through hack only for 127.0.0.1