cookie auth bug fixes, extended Template.route() API