auth cookie when running by IP