set cookie only after user validation, redirects on success/fail