omniauth needs a cookie session