disable cookies for token authentication path