overhaul app sign-on handling. cookie handling is now much more resilient.