I learned that for session-based authentication, the session id is normally stored in the browser'