Update README.md

To avoid session fixation attacks, it is important to
renew the session id every time a sign in is made.

I have updated the example to consider this best practice.
Session fixation attacks are not possible with cookie stores,
but they are with any other session that relies on session id
(memcached, active record, redis and what not).