Fix auth check and cookie handling