avoid requiring re-authentication by storing token in cookie