use cookie session instead of a session