have the x-auth-token be transferred using a cookie on the browser side, avoiding header shenanigans