redirects when user cookie not set