changed authorization to cookie