Refresh session id on Authentication

To prevent session fixation, create a new session id each time authenticate is
called.

refs #5625