session id sent in tell a friend email

[goring_gap]

When a customer uses the tell a friend feature to send an email about a product, the session id is included in the url. I beleive this is a possible security weakness! Does anyone know how to fix this?

 

cheers

Simon