cookie based auth. login forced if auth fails. websocket checks cookie auth