Use SHA1 instead of MD5 to create identifiers for the session protection.
MD5 was found to not be collision resistant in 1996 so it should not be used.