better testing, but not encrypted cookie yet