check cookie on user page, prevent unauthorized access