Security best practice to regenerate session ID on privilege change (logged in v logged out).
Security best practice to destroy the session on log out
Setting session cookie to HTTP only.
Merge pull request #50 from mapkyca/secure_sessions

Secure sessions