https://getmypassword.com/cookie-vs-token/