simplified authentication flow, discarded JWT token authentication, using only cookies