AJAX:
- fixed sessions across sub-domains
- added ability to not redirect on success