authentication and cookie mechanism