Sends session key via POST body instead of url

- Updates legacy.js
- Fixes bug in timeout -- checks for presence first