replace raw cookie with session