multi auth + cookie handling