Fixes so that aker still works

There were two assumptions in the authorization steps
that a cookie would exist
and that the Aker::User was a User record

This commit fixes those problems
merge develop