fixed bug: forgot to resend session cookie in one of the cases