Removed the $sessionId from the request after initial middleware
Added test to confirm that blank sessionIds fail gracefully
Added testing against bogus session ids