why remove session but keep cookieParser?