Add warning for session identifiers

Author: anthonychu

articles/container-apps/sessions.md

@@ -75,6 +75,9 @@ You pass the session identifier in a query parameter named `identifier` in the U
 
 For code interpreter sessions, you can also use an integration with an [LLM framework](./sessions-code-interpreter.md#llm-framework-integrations). The framework handles the token generation and management for you. Ensure that the application is configured with a managed identity that has the necessary role assignments on the session pool.
 
+> [!IMPORTANT]
+> The session identifier is critical and sensitive information that must be securely created and managed. Secure your application to ensure each user only has access to their own sessions, and a malicious user cannot access another user's session.
+
 ### Authentication
 
 Authentication is handled using Microsoft Entra (formerly Azure Active Directory) tokens. Valid Microsoft Entra tokens are generated by an identity belonging to the *Azure ContainerApps Session Executor* and *Contributor* roles on the session pool.