Allowing anonymous user based on condition
You can store a value on the session if the password match and then check that value:

$_SESSION['password_match'] = TRUE;


Or even better, as suggested by @4k4 you can do it the D8 way.

CookieForm class:

$session = $this-&gt;getRequest()-&gt;getSession();
$session-&gt;set('password_match', TRUE);


hook:

$password_match = \Drupal::request()-&gt;getSession()-&gt;get('password_match');