Fix a bug that session_id is not passed through.

The session_id is still needed, see https://github.com/php-loep/oauth2-server/blob/develop/src/League/OAuth2/Server/Resource.php#L193 for reference.