prevent mis-configured servers from leaking cookies