fix abort() on invalid cookie (illegal free)
Merge branch 'master' into 2-random-secrets
simplify authentication logic - fix case of invalid cookie + valid assertion