fixed cookie auth