should only set cookies on sign-in