Do not regenerate session_id

[eluser]gyo[/eluser]
Ok, maybe this is better...

Every time a user logs in you add a record in the "active_sessions" table (session_id, user_id, last_update), but first delete all the other records with the same user_id.

To keep an active user, you check if the "active_sessions" has a record with the current user's session_id.

If there was another user logged in, he will be logged out, since on the next page load the session will not be found in the "active_sessions" table anymore.

Think of it like: the new enters, the old is kicked.

Hope this helps!