replaced cookie system with session