Also pass the session key around

It will be used to get back the user's checkout session in case we
place the Oscar order outside the regular request/response cycle --
such as a POSTback notification.