fix cookie auth