Use configured value for user_cookie lookup
Only process WAF score when it is present