Only empty-string means no session ID.