now saving token stuff in a cookie

Signed-off-by: Chris Jones <chris@jonezy.org>