We considered doing something like this but it would be very hard to ensure no false matches which could result in security compromises.

We also considered placing the session id in the url for the checkout, but again decided against due to security concerns.