Only call session_start() when reading from session

fixes #6383
Purge session when logging out

fixes #6739
Protect login against CSRF

refs #5626