Websites mostly use cookies to authenticate users, and PHP sessions simply to ***** users' actions on the site regardless of their login status.

Of course all sites are different, but it would be very dangerous to use PHP sessions as a basis for authentication when the referrer can be logged by any site they click a link to, thus compromising their account.

You'd need a user's cookie(s) to hijack their account, as far as I've seen.

By the way, I moved this to Internet Privacy.