continue implementing auth based on RSA keys challenges
handle POST /auth/challenges and tokens
fix cookie header