implemented cookies, TODO make them secure