prevent session fixation. fixes #323.
added initial tests