title: How to prevent user to set the value of the session id cookie used by pyramid_beaker?
body: <p>I have a pyramid application using pyramid_beaker. Here is my configuration:</p>
  
  <pre><code># Options For Sessions and Caching:
  session.type = file
  session.data_dir = %(here)s/../../data/sessions/data
  session.lock_dir = %(here)s/../../data/sessions/lock
  # Session Options:
  session.key = session_id
  session.secure = false
  session.timeout = 3600
  session.cookie_expires = true
  session.cookie_domain = .mydomain.local
  session.httponly = true
  # Encryption Options:
  session.encrypt_key = c]?wvL",ni3J.)d8(e~z8b-9Le=Anh'.QMytBj^Kukfi&lt;79C$Cg22)cX;__xs6?S
  session.validate_key = \2R('?pL]\Z_8?(o`.?.?^.RF6t*5pCh6PH`~aon%H`PX$;E}"((mu-@(?G&lt;=!:+
  # pyramid_beaker specific option
  session.cookie_on_exception = true
  </code></pre>
  
  <p>And here is the login form view:</p>
  
  <pre><code>def login(self):
  
      message_html = _('view.login.welcome-message', default='Please log in.')
      login_url = self.request.route_url('login')
      login = ''
      password = ''
      referrer = self.request.url
      if referrer == login_url:
          referrer = self.request.route_url('home')
      came_from = self.request.POST.get('came_from', referrer)
      csrf_token = self.request.session.get_csrf_token()
  
      if 'form.submitted' in self.request.POST:
          login = self.request.POST.get('login')
          password = self.request.POST.get('password')
          if csrf_token == self.request.POST.get('csrf_token'):
              if login in USERS:
                  manager = BCRYPTPasswordManager()
                  if manager.check(USERS[login], password):
                      headers = remember(self.request, login)
                      return HTTPFound(location=came_from, headers=headers)
  
          message_html = _('view.login.failed-login-message', default='Login failed!')
  
      return {
          'message_html': message_html,
          'url': login_url,
          'login': login,
          'password': password,
          'came_from': came_from,
          'csrf_token': csrf_token,
      }
  </code></pre>
  
  <p>Now, when a user wants to log in, the view renders a form and a cookie <code>session_id</code> is generated. When the user submit a valid form then the cookie’s value is accepted to authenticate the user.</p>
  
  <p>Nothing prevent a user to change the cookie’s value before submitting the form. This behavior is apparently a security flaw according to <a href="https://security.stackexchange.com/a/35097/25414">this question</a>.</p>
  
  <p>So, how to use pyramid_beaker in order for the server to generate a new session_id value when login succeed instead of taking the one from the cookie?</p>