Individual ASPState session can be reused by multiple users?!

[Tony]

We are a software company that builds an ASP.Net web application which
implements cookieless sessionState with SQLServer- the session is stored in
the url. Our ASPState database has been built using the standard MS scripts.
The application is used by Admins to look at endusers accounts- permissions
dictate that certain admins have access to certain endusers.

Our Admins (who work from the same facility) have reported problems- stating
while looking at their end users account they are suddenly taken into another
administrators end user account that this other administrator is working on.
Turns out the sessions are criss-crossing.

An administrator bookmarked the login page which contained the session id,
(since ASP.Net creates the session immediately, before any authentication)
and later sent the bookmark to another admin to use. So when both admins log
in, they end up using the same session id and can see each others enduser
depending on who navigates where first with the browser. ASPState doesn't
bark that 2 individuals are using the same session.

This doesn't give us a happy fun feeling we usually have with the dot net
platform. Microsoft MUST already know about such a blatent issue. And we were
surprised that their sprocs that call the AspState tables don't check for
sessions that already exist when attempting to create an initial session.
Basically..

1. User1 uses bookmark with session inside of URL to hit login page.
2. ASPState stores session that was passed in.
3. User1 enters login information and successfully logs in.
4. User2 uses same bookmark with same session inside of url and hits login
page.
5. ASPState doesn't create a new session since it already exists.
6. User2 enters login info and successfully logs in.
7. User1 and User2 sessions are jumbled and private data is potentially
observed.

Does anyone know a way around this?