fix(httpapi): preserve optional session fields