Token authentication

Although, it's a falsy value, it's better to return undefined, since the cookie, well ya know, is undefined.