avoid parsing cookies in two middleware
no need to be picky
basic auth tests and bug fixes