signed cookies now successfully passed between apps
successfully logs in user sets permissions for main app