Then we have to refactor something, this is way too easy to bypass. Implementing a security related function which can get bypassed is snake oil.

Why do you need the magic cookie?