Add test for session stealing bug
Ensure $SESSION is unset before the route is executed

Workaround for session stealing bug (see session-stealing.t)
update Changes and meta for release
bump Changes