login works, cookies need some fiddling with