changed from checking a time value in the cookie to using the HttpHeader instead