user rest with cookie auth