Modified to check both headers and cookies. Renamed cookie specific var names to token.