more structured & cookie can die
basic auth done