added option to prevent session engine from sending cookie