session cookie for payload