In the default settings the session id will be displayed in the url. If someone sees the session id, then he can login into your login session using the session id which can be seen through e.g. scanning a wifi network (Wireshark).