coaching 6: use sessions instead of cookies