create a new random session id.
Subclasses can create custom session ids and should not check if the session exists.