I was referring to calling it unauthorized access. If I do this to my own machines, which is how I wrote and tested this code, then it is entirely authorized.

I would agree that collecting session ids on systems that you do not own or have legitimate access to is almost certainly illegal.