session: Send session token with any POST requests, so you can't 'accidentally' do something drastic to your account if someone sends you a link or something