will be using cookie based authentication, no need for handle_verify_credentials as a separate method