Why would `Authentication` be any different to `Cookie` in this regard? They're both HTTP headers. They both require server side support/implementation. Neither explicitly requires JavaScript.

The only difference I can see is that the browser has a native control for one of them, though that control cannot be customised by the site.