switch to cookie based auth