user authentication use cases added:
 * normal authentication
 * cookie authentication
 * failing authentication (bad credentials)
 * failing authentication (old token)