[DEV] session/cookie logic