fix COOKIE vs SESSION