set cookie, session handler