Should you ‘accept’ or ‘reject’ all cookies? A security expert explains