documented "sessions without cookies"