Refactor the new sessions into two different classes.

One is SessionStorage, which extends ArrayObject and holds the actual data. This should be further abstracted in the future to include all the database-accessing code so you can have multiple backends for the actual storage (similar to the Cache class).

The other is the Session class, which is totally static and extends Singleton. This handles all the things it always has: reading, writing, destroying, etc.
Destroy the session when a user logs out.

We were unsure why we seemed to avoid this in the past. With the new limited sessions, you would continue to send the cookie with each request, and therefore start a new session every page load, if the session were not destroyed.