server side authentication and setting cookies