session_id with allow-origin