Moved session state out of the cookie.