do not check ip in secure cookie
add cookie test, to be continued