use cookie-based authentication per default and fall back to username
and password in case of failure