prevent session id being appended to urls