fix: prevent NPE when we have no cookie at all