switched to simple_form
now writing to session instead of cookie as more secure