Can a session token be generated in pure HTTP?

Authentication & Security
5

OK, no worries and with thanks. And then even if we have POSTed to get the session token we still cannot use a URL only because the params need to be in the header too right?