broke out auth into two engines cookie and credentials