use session and cookie