check for ticket in POST
set a session cookie to avoid hitting CAS for each post