added a method to renew session id on auth to prevent session fixation

call this method during user authentication to prevent session fixation
attacks. the old, unauthenticated session id is re-generated in order to
start a "new" session after login