Function rotate_session_id 

pub async fn rotate_session_id(
    session: &Session,
) -> Result<(), OperationOutcomeError>

Gives the session a new id, keeping its data.

Called whenever the session’s authorization level rises: at password or federated login and when MFA completes. A session id handed to the browser before login (by an attacker who planted the cookie, or just one that was observed) then never becomes an authenticated session.