Track sessions by session.id.
Removed CORS fiddling for now.