added cookie session auth