allow js access to session cookie