added cookie-based authentication test