use both sessions and cookies