get 'session/id' with allow origin