stores session data in  instead of . Uses .url(), instead of .path() which does not remove query string params.