/auth for login endpoint. save jwt as cookie