Clear the session on authenticate

I believe clearning the session before setting session authentication
is standard practice to avoid session fixation attacks.