http: Add notes on cookie based authentication