Fix authorization logic and cookies