How can I allow external host connections based on the presence of a file or cookie on host?

On the cookie part, how does the cookie get there in the first place?

when HTTP_REQUEST {    
    if { not ( [HTTP::cookie exists JSESSIONID] ) } {        
         reject             
    }
}    

On the file part, checking for a file in the client's file system usually requires an agent on the client side. The Access Policy Manager (APM) module can do this natively.