*%session_regenerate_id%* is your friend.