add cookie based sessions, api/session and api/logout