Send session in Cookie header instead of query string

The realtime server sends the session in a Cookie header rather than the URL, matching v16 and develop.