clean
SESSID generated client-side