use JSON for cookie serialization