Session cookie name should be configurable and default to "sessionid".