fix(openapi): send spec with .json(), use cookie auth

fix(openapi): send spec with .json(), use cookie auth #553