note 8165 added to Session handling functions

To php@apt7.com: php-sessions *DOES NOT* store any session data in the client besides the session id. This means that a user can takeover the session of another user if he knows (or guesses) the other user's session id. (all web applications are vulnerable to this attack). You can get a very good idea about how sessions work looking at http://phplib.netuse.de http://www.php.net/manual/ref.session.php