offer rest with cookie auth