fix auth cookie bug