Cookie-based authentication.