startup script
cross-domain cookie auth