added authentication support; work on flash messages/cookies