accept only server-minted cookies