changed default auth to cookie