the way it works is that the client calls the "login" API, which issues an access / refresh token and associates them to cookies against the API domain