Use `env.session_id` instead of deprecated `req.sid`.