CookieStrategy should be done, also moved authorized to UserAccount, but this needs further work