Re-generate session ID on a successful login to avoid session fixation
Add comment I forgot on last commit