frontend now uses the api to handle cookies
api login/logout sets the correct cookies