more work on sessions and cookies, as some anomalies appeared in caldav and firefox which suggested deeper issues