uses Session replace for Cookie