fixed session, added strong simmetric encription of client cookie, so we
can do client side session; every server with the right decription key
(acrtually hardcoded in SessionManager) will use that session.