add jobid callbacks, make webauth optional, return a cookie
stability fixes
Merge branch 'web-auth'