check _shibsession_ cookie on server-side because the cookie is not always accessible from front-end JS