Only write cookie if session is valid