add cookie_seccret
add authentiated, no asynchronous