feature: auth if none cookies