persistent public session and secured private session cookies