tryCookieAuthentication was after session authentication check (should
have been before)