Sorry for a bump but I meant to use session_regenerate_id() when the user logs in. This can help to prevent session hijacking (it isn't 100% effective, mind you!).

Glad you got it working as intended!

Gareth