Cookie scheme, auth try mode

Closes #485 #428