Fixed a bug where the cookie was not checked if a custom authorization
header was added.