using session data instead of cookie