collapse cookie check into auth_is_user_authed()