use random string for session_id