- added cookie store, simplified session handling (removed one redirection)
- no longer get session for assets