fixed auth cookie unsetting