more carefully checking user cookie