storing session token into cookie allows browser refresh without session loss