move user_id cookie creation and deletion to warden callback so it also works with omniauth