changed where the API handler is instantiated so that it can get the cookies from the current request