Don't put JSESSIONID in the url, ever