Unless there is a need of that filename on the client side, otherwise there is no point to pass it around all the time.

I prefer thin client, it is the session identifier shall be passed. The session context shall just be maintained and processed on the server side. Of course, you also need to pass whatever is a must to form the next request, but try to reduce this thru careful design.