progress on cookie based auth