moving session cookie name into settings