yes sou are right.. ... $vbulletin->options['bburl'] should be the same..
as to $vbulletin->session->vars['sessionurl']
i looked into it some time ago .. because in my office the browsers are set not to accept cookies
its only full in that case.. IF cookies are accepted by the browser, then the sessionurl is in the cookies.
there does not need to be a &
when full.. $vbulletin->session->vars['sessionurl']
you also have $vbulletin->session->vars['sessionurl_q']
that gives: ?
the $vbulletin->session->vars['sessionurl_js'] is the same as $vbulletin->session->vars['sessionurl'] but instead of & it only has a & at the end..
actually i only found out about the difference because I ran into the problem and always got logged out when changing pages.
The only reason I see that session url could be there is preventing users to get logged out when their cookies are not enabled..
Because gallery page is called.. with sessionurl from another page..
it is processed.. sessionurl is ok.. so users stays logged in..
when processed page is displayed in browser, the hidden cron image is called..
no sessionurl.. ==> user gets logged out if he doesnt continue surfing within the session timeout.
He only sees he is logged out when he refreshes page.. or moves to another page. thats why i think the $vbulletin->session->vars['sessionurl'] should be there .. whithout the &
If i remember correctly there was an attempt to fix all sessionurls in templates AND code long long time ago.. (brian had inverted some sessionurl and sessionurl_q) .. but i think zach had missed one or two.. because i still get logged out when I surf from the office.. i will run some tests when back from holiday and let you know which ones are errored)