switched to cookie only login