revert back: encrypt session cookie