uses cookies instead of http authentication