added Cookie authentication support
changed createUser method to constructor, moved checking of the
attributes