Tapestry version 4.1 and later do not encode the session id into the url (via response.encodeURL) if the setting "cookies" of context.xml is set to false. I've created a simple test app and put a context.xml into the META-INF folder:
<?xml version="1.0" encoding="UTF-8"?>
If I build the project with 4.0.2, the session id is encoded into ech request. But if I switch to 4.1 or 4.1.1-SNAPSHOT, the session id is not encoded into each reqest.