move over to cookies
update auth
fix tests