nginx.conf

  server {
    location / {
        proxy_cache my_cache;
        proxy_cache_lock on;
        proxy_pass http://backend;

        access_by_lua_block {      
          local token = ngx.var.arg_token or ngx.var.cookie_superstition
          if token ~= "token" then
             return ngx.exit(ngx.HTTP_FORBIDDEN)
          else
            ngx.header['Set-Cookie'] = {'superstition=token'}
          end
       }
  }
}