prevent fixation attack, http://en.wikipedia.org/wiki/Session_fixation