Only /_session request send the authSession. fixed #223

* no auth requests url dont send the authSession
* baseauth dont create session cookie too