Simplify CookieAuth. Move WebFlow authentication to separate method.
Adjust readme#auth.