Add `sessionInvalidate` and `sessionRotate` where needed

[elpete]

Should also handle J2EE sessions which are not handled by the built-in functions.