Update auth

- Cookie could be used for SQL injection
- use empty($row['Avatar'])
Merge pull request #1 from samgeorge/patch-1

Update auth