when 302, it should allow cookie