if you want to fully decouple it you could make a simple server side endpoint that just decodes your cookie to map the logged in user into a subject, and then runs one and only one check