identifying user based on cookie session