more work on sessions and cookies