Regardless of whether the client uses it as a session id or not, the fact remains a sessionid is assigned. Pass the session id in the auth data even if the client did not send it.