fix: set cookie correctly when no user id