improve session cookie handling