use rack explicitly for session/cookies