switched to cookie based sessions