https://shunsei.dev/posts/go-session-fixation-protection/