added cookie verification to authorize check