don't auth without cookies