should this be isAuthenticated rather than getAuthenticated?

and could we fully explain how to handle the cookie to do authentication? that part is still a bit confusing to me. we rewrite it into a special header for the HEAD request... why not leave it in cookie, and how to handle it in the php application?