replace redis based session with security cookie based session