cookie token bug fixed in auth lib