transition to cookie-based auth