ok, no auth cookie