dont check for cookie as it's http-only