added notes on cookies and sessions