use session cookies (stop using permanent)