added the beginnings of cookie auth