prevent session fixation. fixes #323.