title: Pre-post login session id is not changing in rails 2.3.2 app?
body: <p>We build a rails 2.3.2 app and has login/logout mechanism using active_record_store to store the session. </p>
  
  <pre><code>Ruby 1.8.7
  Rails 2.3.2
  Server : Apache (Passenger 4.0.59)
  
  config.action_controller.session_store = :active_record_store
  </code></pre>
  
  <p>Once a user clicks on log out button, we are destroying the session by using rails reset_session function which will drop and create a new session. After successful log out a user will redirect to login page with created session. Again a user login using username-password then user information will store in created session. </p>
  
  <p><strong>Question?</strong></p>
  
  <p><strong>How to reset session after successful login (username-password) and store user info into new session?</strong>
  I want to fix this without device gem.</p>
  
  <p>I tried by executing reset_session function but it is a just empty hash.</p>
  
  <pre><code>def login
      p  session.session_id #7bb32e02c4495b192b233089b0d586c7
      reset_session
      p session # {}
      p  session.session_id # nil
      a = authenticate(username, password)
      session[:app_id] = a.id
    end
  
    def logout
      #old session
      #5a4c229eba44d63058c50a23b104d6f6b6b981bb
      reset_session 
      # new session
      #7bb32e02c4495b192b233089b0d586c7
      redirect_to_login
    end
  </code></pre>
  
  <p><strong>This is an improper session management VAPT issue (Security issue).</strong></p>
  
  <p>Please help me to fix this issue.</p>