block cookies being set in headers