Security best practice to regenerate session ID on privilege change (logged in v logged out).
Security best practice to destroy the session on log out
Merge branch 'secure_sessions' into dev