serve requests when no cookie is set