Auth Fix

fixed hole that allows cookie forgery and logic flaw