env vars for cookies + sessions