attempt to clean up cookie logic, since sessions do not float