disable facebook cookie and only send auth header explicitly