main.js: add GET /session.