add: support cookies as token bearer