cleanup cookie defaults
cleanup logic
fix Authoritative handling
For the auth POST, we know who the user is, so log it
make indent