set access_token cookie only if user
refactoring -