authenticating w/ both a cookie and a login does not appear to be supportable