The sentence is inaccurate, as the user is not assigned a session ID. Instead, generally the visit is. The user is only the controller of the browser, and hence for the most part doesn't see any of this. You can also get rid of the passive voice and make a stronger statement at the same time. Doing all this reduces the need for any gendered language.

When a user visits the website, the site assigns a session ID to the visit and transmits it in the HTTP response. The user's browser stores this ID.

/pedant (n.b. there is at least one grammatical error in the above pedantry)