put HashedControlPassword and CookieAuthentication explicitly in the