only set cookie if not logged in

will avoid sending misleading "first visit" events for users who've already set up their profile