use cookie sessions by default