Use signed "login" cookie for session auth @kselden/@lukemelia