code: protected String createSessionId(HttpResponse response) {
          StringBuilder sessionIdBuilder = new StringBuilder();
          byte[] bytes = new byte[16];
          secureRandom.nextBytes(bytes);
          for (byte b : bytes) {
              sessionIdBuilder.append(Integer.toHexString(b & 0xff));
          }
          String sessionId = sessionIdBuilder.toString();
          HttpCookie sessionCookie = new HttpCookie(idName(), sessionId);
          sessionCookie.setPath(path);
          sessionCookie.setHttpOnly(true);
          response.computeIfAbsent(HttpField.SET_COOKIE, CookieList::new)
              .value().add(sessionCookie);
          response.computeIfAbsent(
              HttpField.CACHE_CONTROL, CacheControlDirectives::new)
              .value().add(new Directive("no-cache", "SetCookie, Set-Cookie2"));
          return sessionId;
      }
docs: Creates a session id and adds the corresponding cookie to the
  response.
  
  @param response the response
  @return the session id