replacing with lambdas
first pass at cookie based sessions