server now properly checks cookie on every non-auth request.