you mean you don't understand why they choose to pass the hashed session id as a url parameter? or dont understand how this works?