switch to UUID + cookie instead of UA+IP hash