simple cookie authentication for a (right now) one-user system