I'm flabbergasted that they include the php session id in the url after all this time. I don't believe its even an option since php 5 and has been disabled by default for many years.