cookie management changes

always send session cookie to requests, generate POST header in the POST
procedure