[FIX] avoid leaving dangling account moves when deleting a bank statement

Fixes #3292
[FIX] web: cors rpc calls were missing the session cookie, resulting in new sessions being created for every call