Behavior: JWT cookie authentication