some controller rework. encrypted cookies. misc