sort out cookie session headers