Comment 19 for bug 978896

Patch looks good to me.

As per the impact description, I'd word the last sentence as such: "Under specific circumstances it is possible to reuse session cookies from another user, potentially allowing access to unauthorized information and capabilities."

e.g. the attacker couldn't actually steal your password, but they could change it for you if you're an admin...