encrypt cookies and use db sessions across