use rack session cookie