多项选择题

A. All URLs returned by the server are rewritten.
B. An HttpSession object is created if necessary.
C. The user name and password of the user are checked.
D. The session ID is stored in the HTTP response as a cookie.