changed express session to cookiesession and moved api to headers