expose authToken instead of raw cookie (needs unit test)