remove commented out code
handle auth token as cookies
use jboss logging