added option to store token in cookie, with additional options for domain, expiration