allow cookies to be sent over cors
save id to session