Session is not passed around http/https