check user against db and set error cookie