add cookie session and fix manual test bugs on redirect to /