cookie and request now include issuer, and require logic checks it