Revised the authentiction section to prohibit a request when cookie and header token are present.
Fixes #1