use a auth cookie to login instead of a constant string, and set it site-wide