adding cookie verification with UA when user agent is different we destory the session and re-authenticate