handshake API

It seems strange to do this here. How about moving it up into the `cookieSession()` bit?