getAuthCookie is now authOnly and redirects if not authed