Decode the sessionID before sending it to the server

Our separator `,` gets encoded on the client-side and we don't decode it before sending it to the server, so `securityManager.checkAccess` fails to split the sessionIDs into the individual IDs, because `.split(',')` does not work on `%2C`.