+ Use HTTP headers not GET parameters for sessionid