working on HTTPBasic and Hawk
CookieStrategy no longer requires SessionExpire
Composite now uses external parameter in login