add check_for_cookie to handle rewrites to set password