refactor and adding cookie authentication