Phase 4 completed: support session cookies