Session fixation across the login boundary

If the session id is not rotated on authentication, an attacker who plants a known id before login rides the victim's session after.