Added notes about cookie authentication