use cookie sessions, not memory sessions