use session instead of cookie