demo app for cookie-session bug