Cookie session with token validation.