session: support cookie domain
move filter wrong http method