fix the cookie decryption logic