added X-Session-Id header, updated POST /session to return id