fixed security leak in auth and made cookie's Path static
made more-or-less working example, added demo keys