security by not returning known visitor id