allow all cookies to be scriptable - non-http_only