cookie set for session vars