authentication within socket.io mixed with express and cookies and sessions