authentication object working, with cookies