use explicit rack session cookie with config