use Lax cookies

There were some weird cases were the browser would not send the cookie
on the first request.

add a few more excludes

add about link to botcheck page