Fix a bug where user-agents could specify their own session ID.