session ID is rotated in \response