db interface verifies cookie