REQ: bump cookie-auth requirement for 1.0.0