handle auth token as cookies