cookies work in the controller