fix for empty title
add http only for cookie
fix for auth token handling
s/def/val/ for performance