session id - must be alphanumeric, min. 32 chars length