encrypting session cookie value before setting it