The ruleset so far

Now that we have secured the request headers, cookies, and "Start new topic" action, this is what the ruleset looks like thus far:

<Location /yabb/>
# Cookie check
SecRule REQUEST_COOKIES_NAMES "!^Y2(Pass|Sess|User)-10491$" \
"deny,msg:'Bad cookie name'"
SecRule REQUEST_COOKIES:Y2Pass-10491 "!^[0-9a-zA-Z]+$" \
"deny,msg:'Bad password cookie value'"
SecRule REQUEST_COOKIES:Y2Sess-10491 "!^[0-9a-zA-Z]+$" \
"deny,msg:'Bad session cookie value'"
SecRule REQUEST_COOKIES:Y2User-10491 "!^[-_0-9a-zA-Z+.]+$" \
"deny,msg:'Bad user cookie value'"
# Header check
SecRule REQUEST_HEADERS_NAMES "!^(Accept|Referer|Accept-Language|Content-Type|Content-Length|Cookie|User-Agent|Accept-Encoding|Host|Connection|Pragma|If-Modified-Since|If-None-Match)$" \
"deny,msg:'Unknown request header'"
SecRule REQUEST_HEADERS:Accept "!^[-\w\s*/,.]+$" \
"deny, msg:'Bad Accept header'"
SecRule REQUEST_HEADERS:Referer "!^[-\w\s*/:^.?=~;]+$" \
"deny,msg:'Bad Referer header'"
SecRule REQUEST_HEADERS...