puavo-web: change to use cookie_store for session