fixed issue #529

session.params were copied into body, then not reset. this caused the the complete set of parameters to be passed in the url.