Ok, so it's being used even though I don't have member tracking via sessions enabled in the CP??

The reason I'm asking is that I read the install guide once again and it recommends placing the directory above the web root. Problem is I can't move the directory as the option isn't directly enabled in the CP, which is where I would normally alter the path/url.