Had it not been a friend I would have assumed as he did that the session id wasn't just slapped in the URL. What was great was when I sent him back "f1reball" and nothing else and he didn't believe that I could have possibly gotten that from the link he sent me.