diff --git a/addons/web/http.py b/addons/web/http.py
index 5e48749df45..f3ae2f34d6a 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -885,8 +885,12 @@ class Root(object):
             session_gc(self.session_store)
 
             sid = httprequest.args.get('session_id')
+            explicit_session = True
+            if not sid:
+                sid =  httprequest.headers.get("X-Openerp-Session-Id")
             if not sid:
                 sid = httprequest.cookies.get('session_id')
+                explicit_session = False
             if sid is None:
                 httprequest.session = self.session_store.new()
             else:
@@ -921,7 +925,7 @@ class Root(object):
 
             if httprequest.session.should_save:
                 self.session_store.save(httprequest.session)
-            if hasattr(response, 'set_cookie'):
+            if not explicit_session and hasattr(response, 'set_cookie'):
                 response.set_cookie('session_id', httprequest.session.sid)
 
             return response(environ, start_response)
@@ -1040,6 +1044,8 @@ class Root(object):
         request.auth_method = getattr(original, "auth", "user")
         request.func_request_type = original.exposed
 
+root = None
+
 def db_list(force=False):
     proxy = request.session.proxy("db")
     dbs = proxy.list(force)
@@ -1090,14 +1096,21 @@ def db_monodb():
     return db_redirect(True)[0]
 
 
-class JsonRpcController(Controller):
+class CommonController(Controller):
 
     @route('/jsonrpc', type='json', auth="none")
     def jsonrpc(self, service, method, args):
         """ Method used by client APIs to contact OpenERP. """
         return openerp.netsvc.dispatch_rpc(service, method, args)
 
+    @route('/gen_session_id', type='json', auth="none")
+    def gen_session_id(self):
+        nsession = root.session_store.new()
+        return nsession.sid
+
 def wsgi_postload():
-    openerp.wsgi.register_wsgi_handler(Root())
+    global root
+    root = Root()
+    openerp.wsgi.register_wsgi_handler(root)
 
 # vim:et:ts=4:sw=4:
diff --git a/addons/web/static/src/js/corelib.js b/addons/web/static/src/js/corelib.js
index 007a0adc803..3b328fb8765 100644
--- a/addons/web/static/src/js/corelib.js
+++ b/addons/web/static/src/js/corelib.js
@@ -967,6 +967,8 @@ instance.web.JsonRPC = instance.web.Class.extend(instance.web.PropertiesMixin, {
         instance.web.PropertiesMixin.init.call(this);
         this.server = null;
         this.debug = ($.deparam($.param.querystring()).debug != undefined);
+        this.override_session = false;
+        this.session_id = undefined;
     },
     setup: function(origin) {
         var window_origin = location.protocol+"//"+location.host, self=this;
@@ -1009,7 +1011,6 @@ instance.web.JsonRPC = instance.web.Class.extend(instance.web.PropertiesMixin, {
         var deferred = $.Deferred();
         if (! options.shadow)
             this.trigger('request', url, payload);
-        payload.debug = this.debug ? true : false;
         
         this.rpc_function(url, payload).then(
             function (response, textStatus, jqXHR) {
@@ -1055,7 +1056,10 @@ instance.web.JsonRPC = instance.web.Class.extend(instance.web.PropertiesMixin, {
             dataType: 'json',
             contentType: 'application/json',
             data: JSON.stringify(payload),
-            processData: false
+            processData: false,
+            headers: {
+                "X-Openerp-Session-Id": this.override_session ? this.session_id : undefined,
+            },
         }, url);
         if (this.synch)
             ajax.async = false;
@@ -1134,11 +1138,10 @@ instance.web.JsonRPC = instance.web.Class.extend(instance.web.PropertiesMixin, {
     },
 
     url: function(path, params) {
-        var qs = '';
-        if (!_.isNull(params)) {
-            params = _.extend(params || {}, {session_id: this.session_id});
-            qs = '?' + $.param(params);
-        }
+        params = _.extend(params || {});
+        if (this.override_session)
+            params.session_id = this.session_id;
+        var qs = '?' + $.param(params);
         var prefix = _.any(['http://', 'https://', '//'], _.bind(_.str.startsWith, null, path)) ? '' : this.prefix; 
         return prefix + path + qs;
     },
diff --git a/addons/web/static/src/js/coresetup.js b/addons/web/static/src/js/coresetup.js
index f153d3ad73a..3ba5855533f 100644
--- a/addons/web/static/src/js/coresetup.js
+++ b/addons/web/static/src/js/coresetup.js
@@ -38,11 +38,10 @@ instance.web.Session = instance.web.JsonRPC.extend( /** @lends instance.web.Sess
         var self = this;
         this.setup(origin);
         instance.web.qweb.default_dict['_s'] = this.origin;
-        this.session_id = false;
-        this.uid = false;
-        this.username = false;
+        this.uid = null;
+        this.username = null;
         this.user_context= {};
-        this.db = false;
+        this.db = null;
         this.module_list = instance._modules.slice();
         this.module_loaded = {};
         _(this.module_list).each(function (mod) {
@@ -56,8 +55,6 @@ instance.web.Session = instance.web.JsonRPC.extend( /** @lends instance.web.Sess
      */
     session_init: function () {
         var self = this;
-        // TODO: session store in cookie should be optional
-        this.session_id = this.get_cookie('session_id');
         return this.session_reload().then(function(result) {
             var modules = instance._modules.join(',');
             var deferred = self.rpc('/web/webclient/qweblist', {mods: modules}).then(self.load_qweb.bind(self));
@@ -80,7 +77,19 @@ instance.web.Session = instance.web.JsonRPC.extend( /** @lends instance.web.Sess
      */
     session_reload: function () {
         var self = this;
-        return this.rpc("/web/session/get_session_info", {}).done(function(result) {
+        var def = $.when();
+        if (this.override_session) {
+            if (! this.session_id) {
+                def = this.rpc("/gen_session_id", {}).then(function(result) {
+                    self.session_id = result;
+                });
+            }
+        } else {
+            this.session_id = this.get_cookie('session_id');
+        }
+        return def.then(function() {
+            return self.rpc("/web/session/get_session_info", {})
+        }).then(function(result) {
             // If immediately follows a login (triggered by trying to restore
             // an invalid session or no session at all), refresh session data
             // (should not change, but just in case...)
@@ -326,7 +335,7 @@ instance.web.Session = instance.web.JsonRPC.extend( /** @lends instance.web.Sess
         }
 
         _(_.extend({}, options.data || {},
-                   {session_id: this.session_id, token: token}))
+                   {session_id: this.override_session ? this.session_id : undefined, token: token}))
             .each(function (value, key) {
                 var $input = $form.find('[name=' + key +']');
                 if (!$input.length) {
diff --git a/addons/web/static/src/xml/base.xml b/addons/web/static/src/xml/base.xml
index a459486bf05..643bca0e798 100644
--- a/addons/web/static/src/xml/base.xml
+++ b/addons/web/static/src/xml/base.xml
@@ -654,7 +654,7 @@
                             <t t-set="fileupload_action" t-translation="off">/web/binary/upload_attachment</t>
                             <input type="hidden" name="model" t-att-value="widget.dataset and widget.dataset.model"/>
                             <input type="hidden" name="id" t-att-value="widget.model_id"/>
-                            <input type="hidden" name="session_id" t-att-value="widget.session.session_id"/>
+                            <input type="hidden" name="session_id" t-att-value="widget.session.session_id" t-if="widget.session.override_session"/>
                             <span>Add...</span>
                         </t>
                     </li>
@@ -1320,7 +1320,7 @@
     <div t-attf-class="oe_hidden_input_file #{fileupload_class or ''}" t-att-style="fileupload_style">
         <form class="oe_form_binary_form" t-att-target="fileupload_id"
             method="post" enctype="multipart/form-data" t-att-action="fileupload_action || '/web/binary/upload'">
-            <input type="hidden" name="session_id" value=""/>
+            <input type="hidden" name="session_id" value="" t-if="widget.session.override_session"/>
             <input type="hidden" name="callback" t-att-value="fileupload_id"/>
             <t t-raw="__content__"/>
             <input type="file" class="oe_form_binary_file" name="ufile" t-if="widget.widget!='image'"/>
@@ -1372,7 +1372,7 @@
                 <t t-set="fileupload_action" t-translation="off">/web/binary/upload_attachment</t>
                 <input type="hidden" name="model" t-att-value="widget.view.model"/>
                 <input type="hidden" name="id" value="0"/>
-                <input type="hidden" name="session_id" t-att-value="widget.session.session_id"/>
+                <input type="hidden" name="session_id" t-att-value="widget.session.session_id" t-if="widget.session.override_session"/>
             </t>
         </div>
     </div>
@@ -1835,7 +1835,7 @@
 <t t-name="ImportDataView">
 <form name="import_data" id="import_data" action="" method="post" enctype="multipart/form-data"
         class="oe_import oe_import_no_result">
-    <input type="hidden" name="session_id" t-att-value="widget.session.session_id"/>
+    <input type="hidden" name="session_id" t-att-value="widget.session.session_id" t-if="widget.session.override_session"/>
     <h2 class="separator horizontal">1. Import a .CSV file</h2>
     <p>Select a .CSV file to import. If you need a sample of file to import,
        you should use the export tool with the "Import Compatible" option.