support that token can be stored in cookies