Bir cookie kullanarak ya da değil, bu PHP seçenekleri tarafından yapılandırılır:
If the first one is set, cookies will be used if possible.
PHP should detect if cookies are enabled or not, and use them only if they are supported by the client.
To enable passing of the session id by GET instead of cookies, you might have to activate session.use_trans_sid, which is disabled by default (Which means that, by defaut, session id is only passed by cookies -- never by GET).
But note that, with this option activated, PHP will pass the session id by GET at least for the first page each user of your site will come to... as they won't have the cookie at first, and the only way to check if they support cookies is by setting one, and trying to read it back on the next page.
And users that don't support cookies, including search engines I'd probably say, will have that session id -- and that is not nice :-(
And, you might also want to take a look at session.name to set the name of the key (set to to "token" instead of "PHPSESSID", I mean)
For more details, you can take a look at the Session Handling section of the manual :-)