allow for authentication bypass
bypassAuth for cookie based logins
make it clear that _refreshTokenFail is an internal option
add test cases for bypassAuth
Merge commit '3616652' into HEAD