persistent login works using api_key cookie