Fix a bug where user-agents could specify their own session ID.

Signed-off-by: Tyler O'Meara <Tyler@TylerOMeara.com>