Update README.md

To avoid session fixation attacks, it is important to
renew the session id every time a sign in is made.

I have updated the example to consider this best practice.
Session fixation attacks are not possible with cookie stores,
but they are with any other session that relies on session id
(memcached, active record, redis and what not). 

PS: Sorry by adding a new line at the end of the file, Github did it automatically :S