Remove Session Token from Url

remove the session id from the url parameters, falls back to the
cookie based session system.
NOTE: Requires disabling the XSRF attack detection as this relies on
the session token being present. This should be re-enabled using e.g.
a second token.
Extend Notification handler to accept additional vars from context
Fix session handling on binary requests
Some small fixes
First draft XML export workflow