token invalidation and cookie security