also look for token in cookies