support cookie (session) based http security API