Re-used processes don't require login

[Thomas Berezansky]

When a new connection gets a process that had previously logged in the client can skip the login process entirely and continue on as though they were the previous user on that process.

I have an apparently working fix in the new SIPServer security repo (<email address hidden>:security/SIPServer) in a branch named "reset_account_info".

[Galen Charlton (gmc)]

I've reproduced the problem (by running a SIP server that has max_servers set to 1) and successfully tested Thomas's patch.

I've pushed a signed-off version of it to security/reset_account_info_signedoff along with a follow-up that does two things:

- makes explicit the already implicit requirement that 93 be the first message presented when using the raw transport
- tweak the logging for clients that break that convention -- hopefully this will make it easier to identify clients that don't attempt to log in first.

[Galen Charlton (gmc)]

From my POV, while it would be nice if my follow-up got pushed (assuming successful testing), Thomas' patch by itself is sufficient to close the security hole.

[Bill Erickson (berick)]

Sign-off to Galen's patch pushed to security/reset_account_info_signedoff2

[Galen Charlton (gmc)]

Pushed Thomas' patch to master. My follow-up patch is now superseded in part by the 99-then-33 work.