Hand clients HTTP sessions that need to be sent in HTTP request headers

Requests without the headers or mismatching session id will return 403 forbidden
Add window.connectCount property so that server changes can be detected from AS