if there is a cookie, use it. Otherwise ask server
more strict cookie validation