improved access control headers for auth and cookie managment