send cookies, no csrf for now