better handling on invalid rememberme cookies