moved from storing in cookies to encrypted sessions