Security Proposal clarification

This message was sent from: Development
http://forums.oscommerce.com/viewtopic.php?p=149360#149360
----------------------------------------------------------------

Dumb questions, however, my version of OSC includes a switch within application_top:

// Use Search-engine Friendly URL's (only works in Apache)
  define('SEARCH_ENGINE_FRIENDLY_URLS', false);

To my mind, this removes the session ID from the URL presumably by storing it in another environmental variable on Apache?

Is the Security Proposal defined within this thread addressing non-Apache servers or am I missing the whole point?