Drop cookie on bad auth