Implementing an alternate BREACH solution - masking session_id by XORing with a nonce per request