invalid security cookie is now deleted on the client so it will not be resend all the time