Cookie and password auth work