session: replace cookie with cookies