Added querySession flag to req

Pull session out of req.query.authToken if req.querySession is set.