login/login pages and cookie/session-based auth