check session before cookies
check sessions before cookies