use correct auth cookie