Small session lookup tweak during auth check
Added optional URL param to Event stream for manual auth check

This change is to workaround the problem of the Server Sent Events (SSE)
spec only recently gaining support for CORS and (at the time of writing)
no browser support.