Support non-secret cookie validation