I would recommend not just moving the location of the sessions, but rather storing them in a database and not in a file. No matter where you tell php to store the session in a file it can easily be read if an attacker can place a script on the server and access it through the web. Also make sure to encode all session data so that it cannot easily be read.
But not a bad list to start with.
