cleanup
update npm dependencies
sessions no more in cookie