Putting session keys in a GET URL happens a lot (whether it "should" or not :-)). It's an authentication scheme for access to the URL: your GET may or may not

Putting session keys in a GET URL happens a lot (whether it "should" or not :-)). It's an authentication scheme for access to the URL: your GET may or may not actually have "side effects" regardless, that's orthogonal.