I still can enter the site with out login

[tawfiknasser]

Two ways
1- after deleting the cookies i still can act as logged in
2- i used postman to send post request and it worked, i can see the content that only authenticated users should see

you should verify the user on each request that need to be verified.