Use $document instead of $cookies

Turns out that $cookies uses a polling mechanism to find out if there are changes to the underlying document.cookie string. This doesn't jive well with this service as upstream callers are watching for changes to it and cause it to clear the profile should no cookie exist. The functionality is important to prevent the appearance of being signed in without actually being signed in.