What tampering is this signature protecting you from? Assuming if someone can get your sessionId they can also get the signature as it is passed in the same URL.