fix bug in session cookie code