I hate the MCP rules so much. That I made cookie based auth work by just passing stuff through mimicking the oauth flow.