LPS-39310 Don't leak jsessionid by default