no cookies! authentication + ui