title: Using Spring Security Without Cookies
body: <p>I need to implement session management in a Spring app for a mobile browser that doesn't support cookies.  Can this be done by putting the session id in the querystring of a GET request?  How do you manage this with Spring? Is there a built-in option I'm missing?  Should I write my own auth filter?  Are there special security issues to consider with this approach?</p>
  
  <p>We're running Spring 2.0.6, so I'd be using Spring Security 2.</p>