Always generate a new id when building a session

This solves a bug when simultaneous requests want to access a session
no longer present in MongoDB. Both used to instanciate a new session
with the id given in the cookie. Since the session's id is an unique
index, mongo would raise an error.