If anyone else out there is running a cookie-less 4.7 site (which requires porting trans_sid code from the 4.6 drupal_goto() function) and is having problems running the update script the answer is that cookies need to be enabled (in php) for the update to work (i.e. the PHPSESSID url string is not working properly with the refresh code).

You need to change the following in settings.php before hitting update.php
From:

// Cookies off
ini_set('session.use_only_cookies', 0);
ini_set('session.use_trans_sid',    1);
ini_set('session.use_cookies',  0);

To:

// Cookies on
ini_set('session.use_only_cookies', 1);
ini_set('session.use_trans_sid',    0);
ini_set('session.use_cookies',  1);

After updating you can switch the settings back to get your nice ugly PHPSESSID URLs back again :)