basic local auth with session cookies