Moved session checking from JSESSIONID to request.session.session_key