move CheckCookie processing to AuthRedirectHandler