Raw `session_start()` on init after output; legacy `session_id()` guard; sha256 ownership

A raw PHP session is started on every request with a weak guard, confirmed live by the session cookie.

init.php:1055