change session to cookieSession