they mention cookies. that not the correct method for authenticating to the API, OAuth is.