implement login func
set maxAge and httpOnly for auth cookie