auth with cookie (super secure! :+1:)