Allowing sending the session key in a http header