Confirmed cookie-based authentication works.