J2EE Misconfiguration: Insufficient Session-ID Length