don't ever allow empty session id