add checking of session cookie in AuthSpec