I couldn't get it to work that way either JJR. It works properly without including the sessionhash as far as I can see. The only thing I did different is I added the sessionhash to all of my links in the forum. So SiteNews.php has a link with the sessionhash included. In other words I didn't add the sessionhash to the link in the hack, I added the sessionhash to the link in the forums that takes you to that page.
Hope this helps...