cookies are sent with every request, you were lucky to have >28k modem back then. Json didn't really exist, xml was king.

There were plenty of reasons. Apache needed a mod to store a session in a cookie instead of a url and HTTPS was really hard to do. Java had its way, PHP had another, ASP had another... everything was different and there were no patterns.

56k modems were pretty routine by 1999 and ISDN (It still does nothing) was a thing. But by 2000, DSL rollouts were starting to happen.