It seems that your PHP configuration allows sessions to be tracked via URL parameters, as well as cookies. You can fix this by switching off the session.use_trans_sid setting, or try adding this in qa-config.php:
ini_set('session.use_trans_sid', false);
I'll also add this in the appropriate place in the next version.