[JENKINS-22358]

Do not put session ID in the URL, which is like asking for the session
hijacking attack.

While it is unclear how JENKINS-22358 happens when several reporters
claim they have not disabled cookies, the failure mode clearly indicates
the session ID is added to the URL, so disabling that altogether at the
container level should resolve the problem.

With this change, if the cookie is not enabled, a login will succeed
but one can never login, because as soon as the user logs in, the
browser promptly forgets that session and will appear as a new user.

In the future perhaps it would be desirable to detect the browser that
doesn't support cookie, and warn the user accordingly.