what do you use for auth if not cookies? genuinely curious