check for cookie header