added a lot of debug logging
fixed a bug in the url sanitizer logic to remove ;jsessionid