remove handler, add CookieSession
rename handler.go -> cookiesession.go