When using the content bank and selecting different category or course contexts, the URL becomes:

http://localhost:8000/contentbank/index.php?sesskey=mrF1itzAqH&contextid=3

We should not leak the users sesskey in GET requests like this

It's a regression from MDL-77148, specifically these block which both unconditionally add a 'sesskey' parameter (previously this would only be added for POST requests)