add cookie and session