Alright, so it's not an issue with the browser caching. I double checked and it doesn't look like that code changed much in 3.6 anyway.
Are you seeing any other errors in the server side logs like Invalid session err=ERROR or Invalid session token=TOKEN, err=ERROR? Perhaps you could send me your latest server logs to take a look at? If you sign up to our public instance of Mattermost where I'm @harrison, you can send them directly to me in a DM.