added "renew_session_id" method

call this method during user authentication to prevent session fixation
attacks. the old, unauthenticated session id is re-generated in order to
start a "new" session after login