optionally allow signed cookies
escape token injected into html