fixing wrong token loading

backend/routes/agent.py

@@ -206,11 +206,13 @@ async def create_session(
 
     Returns 503 if the server or user has reached the session limit.
     """
-    # Extract the user's HF token from the Bearer header
+    # Extract the user's HF token (Bearer header or HttpOnly cookie)
     hf_token = None
     auth_header = request.headers.get("Authorization", "")
     if auth_header.startswith("Bearer "):
         hf_token = auth_header[7:]
+    if not hf_token:
+        hf_token = request.cookies.get("hf_access_token")
 
     try:
         session_id = await session_manager.create_session(