test coverage for allowed insecure cookies