require user to configure cookie security requirement