Regenerate session ID when logging in / out

(#905 part 1)