move auth header parsing to base http code; reformat cookies a bit
reorganize login code to generally work