updated to sessions rather than cookies