fix: disable cookie auth for non GET requests

http/auth.go

@@ -53,10 +53,12 @@ func (e extractor) ExtractToken(r *http.Request) (string, error) {
 		return auth, nil
 	}
 
+	if r.Method == http.MethodGet {
 		cookie, _ := r.Cookie("auth")
 		if cookie != nil && strings.Count(cookie.Value, ".") == 2 {
 			return cookie.Value, nil
 		}
+	}
 
 	return "", request.ErrNoTokenInRequest
 }