Fixed bug that allowed authentication with no cookies and any id parameter in GET/POST