successful login sets cookie
prevent unauthenticated post to /location
make cookie salt an env variable