Add some security fixes to session support.
* Regenerate session id in any authentication change.
* Destroy session, and all vars on logout.

TODO: Check USER_AGENT and REMOTE_ADDR? Maybe later..
* REMOTE_ADDR, can change suddenly.
* USER_AGENT, some browsers change it to improve compatibility.