there are 2 points needs attenation
1. the session is updated after the logon for security consideration
2. there is another parameter cquid, which is also required for CQ server to accept any request after logon
You may check the request in Firebug or Chrome to find this
