[HttpFoundation] Session id can be stored not only in cookies

If `session.use_only_cookies` & `session.use_cookies` is `false`, session id can come from `GET`.