cookie and ip validation are both optional