handler: allow session id to be sent as URL param