server: auth: verify session cookie