cookie works, session works, delete is bugged