hash session IDs since some aren't random afterall