The client should have already established a session or used the state to store things. Removing it from the request will make sure people don't accidentally think this is trusted information at this stage.