Checks the cookie first because it is a cheaper check. This also renames
enabled_for_user? to allowed_for_user? since that is more accurate.