Application cookie basically working
CookieAuthentication process understood
Apply custom 401 behaviour if necessary
ExternalLogin working
Auth with ExternalCookie working