ENT-656: fix session fixation (CWE ID 384)