Friend should rotate session identifiers upon privilege escalation events

[RutledgePaulV]

Hi!

I noticed that friend doesn't reissue session ids on successful authentication (or role changes) but the security world generally believes this to be good practice since it mitigates a number of other risks.

https://www.owasp.org/index.php/Session_Management_Cheat_Sheet#Renew_the_Session_ID_After_Any_Privilege_Level_Change

[cemerick]

Good suggestion. Should be easy, looks like Ring now supports easily regenerating session cookie IDs (via :recreate session metadata).