comment out header logging - don't think this is required for the
browser to stash the JSESSIONID cookie