use "_shibsession_" cookie instead of "auth"