Remove redundant 'private'
Ensure auth cookie is used in subsequent requests