auth errors should signal the cookie name