authentication now uses cookie