add cookie string generation and verification