Ixnay on the check a session cookie check, at least to the content-server. The content-server does not set any session cookies. It doesn't look like the auth-server does either. @ckarlof - am I missing something major here?