- added a(n ugly) way to handle session timeouts in JSON requests
- added some missing JSON access checks
- fixed a potential NPE in saving query comments