using Uri.Escape and Unescape for the session cookie