I run an online ecommerce website, and when people's orders are complete they are shown an 'order complete' page listing the details of their order. The session ID is stored in the URL along with the order number - this really shouldn't be public. Maybe a regex for 'hide these URLs' could be created?