change session checks to GET without payload and fix parsing