we now store the old session as a hash before the session is reset in or...

...der to protect against session fixation attacks