basic client cookie for auth