Mitigate session fixation attacks.

- Enforce cookies for SID.
- Reject user-generated SIDs.
- Regenerate SID on login.
- Expire the session cookie on logout.
Restrict session cookies to $masterPath.
Make the language cookie depend on the session name too.
Revert 71d4873 and remove $sessionName entirely.

Since all cookies now specify the path (see 83beeb2), the name prefix is useless.