fixed auth with cookie bug