Session Vars in URL

They're probably showing up because you have a <CFLOCATION> tag without the addtoken="no" attribute in your code somewhere. Start with that. Also check your code for the use of the URLSessionFormat() function which will pass those through the URL.