cookies are sent with every request, you were lucky to have >28k modem back then. Json didn't really exist, xml was king.

There were plenty of reasons. Apache needed a mod to store a session in a cookie instead of a url and HTTPS was really hard to do. Java had its way, PHP had another, ASP had another... everything was different and there were no patterns.