Of course you can activate the 301 on all pages, I actually assumed that, but it was about the cookie that can be stolen via problem #4.