authenticating only once. setting the access token on cookie