don't make an old session active again, user has to request a new session id, fixed session handling