Replace express-session with hand-baked cookies