It only shows the session ID in the URL if it has to - i.e., if the browser refused to accept the session ID cookie. If it does, PHP has to store the session ID somewhere else so that it gets returned with each browser request - in the querystring.
<?=SID?> (more accurately, page.html?<?=SID?> is only needed if there's a possibility that browsers of the site won't accept the cookie.
So if the site's not working, and the browser is accepting cookies, then SID's not at fault.