optionally allow signed cookies, escape token injected into html

still needs tests, trying to wrap my head around that now