add support for cookie borne access tokens via fork of passport-http-bearer
break out auth response