add authentication with a session cookie