Cookie based auth seems to work now.