http://randomcoder.com/articles/jsessionid-considered-harmful