use GET for auth instead of cookies