changed from cookies to session management