fixed #42 added web filter removing jsessionid from incoming urls