make cookie auth work