use session cookies by default