Application authentication is done by cookie (instead of parameters)