Change all OWASP_CRS/WEB_ATTACK/SQL_INJECTION rules to stop looking at cookies because of false positives