session id can be hexadecimals chars with dashes