* feat(auth): allow skipping forced recovery key download * refactor: move from session storage to cookie