3.10 Session ids may only come from framework

Verify that only session ids generated by the application framework are recognized as active by the application.

Levels: 2, 3