server auth
auth-cookie works
merge conflicts resolved