start session before setting cookie