changed auth token storage to cookies with expiration