add missing "var" declaration found with "use strict"

Currently the code leaks the `query_str` variable into globals because it's missing a "var" declaration, and because it does not "use strict", no error is thrown. However, when session.js is concatenated with other scripts which "use strict", strict mode is applied to the session.js code as well, and the missing var declaration causes an error to be thrown, which breaks everything.