Update auth

- Cookie could be used for SQL injection
- use empty($row['Avatar'])