PSGI-based fileserver with cookie auth