add a session cookie for the user