some basic cookie handling: just atoken so far