fix auth to use cookies