prepare 2.5.1.1 release
tighten up encoding on cookie auth