better fix for blank session cookie

My coworkers do not like my patch which will invalidate current session. They suggest a better fix : generate a new sid if empty one (as it's already done with nil sid)