Added config option to disable the session cookie; added config key for session header, closes $1461