private instance · no cookies beyond the session