authorization by cookie is working