There isn't one - the session identifier is an example of an opaque token