Barclaycard ePDQ for 1.3.7

[kuroi]

Basically Barclays require an absolute URL and does not allow session ids.

It's possible that you're mixing up the POST and return URLs here. Though your comment would apply to both but at a more fundamental level.

It seems to me that Baraclays are stripping away all URL parameters (which does have some security benefits) and replacing them with the order ID for the return URL and the transaction status data for the POST URL. Dynamic URL parameters such as used by Zen Cart by default and session IDs are just two examples of what gets stripped.