documented use of server-side sessions