bugfix: user-agent and cookie are on request, not session