Refactor cookie/session handling