keeping a session id in the URLs is way less secure as it is susceptible to XSS attacks, it can leak in referer headers, it can be accidentally shared by people copy & pasting the URL and by extension, the session ID might even end up in a search engine and depending on your bad luck, the bots might visit the page just often enough so the session doesn't expire on the server at which point an authenticated session is in the search engines.
Session cookies on the other hand can be marked as http-only, mitigating XSS in many browsers (there are some that still screw this up with XmlHttpRequest) and by not having the session id in the url, the id is much less likely to be shared with others, nor to appear in search engines.
Also, it keeps the URLs nice looking.
So why exactly would one want to disable session cookies?
Because of all of the above reasons, I'd much rather keep users with cookies disabled away from my application than to subject them to the ugly URL fallback which will impact their security much, much more than the perceived privacy loss of session cookies (which go away when you close the browser)
