Pages that link to CWebUser.allowAutoLogin must be set true in order to use cookie-based authentication.