auth and cookie figured out