cookie auth validateFunc optional
cookie scheme