use cookies instead of session XML