user lives in cookies not session