make clear that the session is based on cookies in the documentation