Clear the session on authenticate

I believe clearning the session before setting session authentication
is standard practice to avoid session fixation attacks.
Merge pull request #6 from bemurphy/thwart_fixation

Clear the session on authenticate