Only allow requests with valid cookie if the user is specified in the url