url params instead of cookies