Bug: session headers incorrectly passed to next request