https://adewakun.blogspot.com/2018/08/session-fixation-non-https-or-ssl.html