Comparing the session-fixation-protection options