only send a session cookie when it's actually needed