[FIX] web: cors rpc calls were missing the session cookie, resulting in new sessions being created for every call