signature is now only sent when session id is available and required