fix(session): pass URL objects directly to fetch to satisfy Codacy tainted-URL rule view more