fix session handling: do not use session id stored in Thread if HttpContext.Current is available.
Otherwise sessions have been reused, and the client did not receive a session id.
fixes #13