cookie auth work in progress