only check for cookie if user is logged in