session problem solved. correct corsheader in routes.php and corsfilter correct