update oauth2
added extra check for req.cookies on util.parseToken