prevent 'my_address' being set with bogus info

Created by: waitman

After a user has authenticated, it is possible to set my_address in $_SESSION to 'anything' using zid= parameter in URL - if user is authenticated then zid is never validated but the session variable is updated. This change kills the authenticated switch if a person sends a new zid through for processing, which will trigger remote authentication.