set cookie auth url in setuphandlers.