We should use `request.session.session_key` which works for Django setups that don't use session cookies too.