refine login, with or without cookie