refactor how two factor auth token (cookies) in browser are created and validated for better security