Only supporting cookie authentication for now

Digest requires access to the raw secret as far as I can tell, which
does not work if we are never storing the raw secret in an unhashed
form.