Fixed session/cookie login vulnerability.

findOrCreateUser originally trusted whatever cookie was passed in as an argument as valid. The functio

The fix was to double check the cookie and make sure it's the cookie belonging to the corp session.