protected Serializable getSessionId(ServletRequest request, ServletResponse response) {
        return getReferencedSessionId(request, response);
    }
Stores the Session's ID, usually as a Cookie, to associate with future requests.

@param session the session that was just {@link #createSession created}.
web/src/main/java/org/apache/shiro/web/session/mgt/DefaultWebSessionManager.java