Make cookieLogin handle HttpSession by itself
Delete method UserService.login(HttpSession) and copy body to callers