Add tests of cookie based auth