session-tracking over get-param, if browser does not allow cookies.