re-added support for passing session id's in the URL, re-ordered the check sequence

got missing somewhere..., order is: post,cookie,get,headers