1. if username or password not ok, reject.
2. if database has cookie and client not have cookie or not same cookie, and the database cookie has not expired, reject
3. if client has no cookie, create one and add to database. either way, update the last seen time in database