both cookie and cred auth is looking good