don't store multiple user's auth tokens in a permanent cookie, not worth the management work