my server allows rewrite rules.

so . . . if someone has cookies disabled they can bypass this? should kick to the error page also no?