Fix and simplify session lookup

* Use SESSION_COOKIE_NAME for sessions