code: def generate_session_id(secret_key=settings.secret_key_bytes(), signed=settings.sign_sessions()):
      
      secret_key = _ensure_bytes(secret_key)
      if signed:
          # note: '-' can also be in the base64 encoded signature
          base_id = _get_random_string(secret_key=secret_key)
          return base_id + '-' + _signature(base_id, secret_key)
      else:
          return _get_random_string(secret_key=secret_key)
docs: Generate a random session ID.
  
      Typically, each browser tab connected to a Bokeh application
      has its own session ID.  In production deployments of a Bokeh
      app, session IDs should be random and unguessable - otherwise
      users of the app could interfere with one another.
  
      If session IDs are signed with a secret key, the server can
      verify that the generator of the session ID was "authorized"
      (the generator had to know the secret key). This can be used
      to have a separate process, such as another web application,
      which generates new sessions on a Bokeh server. This other
      process may require users to log in before redirecting them to
      the Bokeh server with a valid session ID, for example.
  
      Args:
          secret_key (str, optional) : Secret key (default: value of 'BOKEH_SECRET_KEY' env var)
          signed (bool, optional) : Whether to sign the session ID (default: value of
                                    'BOKEH_SIGN_SESSIONS' env var)