set cookie policy to always allow