tests for cookie policy
more comments in auth doc