svc: add HTTP session handling