Session IDs susceptible to session fixations attacks