working cookie passing but broken auth_cookie
simplified with encoding done serverside
working auth and session passing