Issues a new session id while keeping the current data.

Call this on privilege change (most importantly immediately after login) so that a session id an attacker planted before authentication does not carry into the authenticated session — session fixation. On the store strategy the previous entry is deleted, making this a real revocation.