login only if requested
reusable cookie jar