switch to cookie-session package