fixed #2399 - audit detected shell commands for web-ssh sessions (#2407)