Transfer session in request / response

fixes #7

The downside of this patch is obvious: The session is transferred through the querystring / response body.
This lowers security (which shouldn't be too much of a problem for this, though).
Transferring the session in the querystring limits it to the maximum URL length (8KB?).
The session is small enough to not suffer from that.