Added ability to read session from non-cookie header