[chore] Missing information for the Session fixation security page

[sarjona]

What do we need to do?

Page /general/development/policies/security/session-fixation is incomplete. It would be great fill-in missing sections :-)

[mickhawkins]

I have made a note of this and will try to review this during my project week, as well as any of the other security dev docs pages I have time to get through.