verify that logging in sets a cookie