GET forms shouldn't include the session key by default