Only set cookie when logged in

This makes it so a cookie is only set when a user is logged in (or if we set something else in the cookie in the future).

This should get us down to 0 cookies for logged out users, which will allow us to do more aggressive caching in the future.