fixed missed authentication check if client doesn't send cookie