fixed cookie parser to be before sessions