/search: use GET not POST; ditch session attrs