In order to fix a potential vulnerability known as
session fixation, a new session cookie id is generated upon
succesfull login.