Session IDs susceptible to session fixation attacks