I think this is confusing from a functional point of view. This is basically coupling the cookie provider into the authorization manager. Since we can have multiple authorization providers, let the implementer have the cookie authorization provider at the end of their `authorization types` instead of forcing it here.

IMO it is the developer's responsibility to provide the authentication types they want.