Originally posted by Saruman
Do not include it in the URL and use cookies to store it. But remember that user may disable cookies so you must check it.
Note that this may require you to turn off session.use_trans_sid in your php.ini.
But then like Saruman says, you won't be able to keep session data for people with cookies turned off.