include application session id in headers instead of using post parameters