Why you need cookie-based Auth for the Next.js App Router (2024)