added session cookie to authorization