Bugfix: cookie poisoning is always enabled

Signed-off-by: Paul Yang(InfoHunter) <paulyang.inf@gmail.com>