This is in the Ruby On Rails Security Guide: http://guides.rubyonrails.org/security.html#session-fixation

The author isn't telling people anything new, so it shouldn't take the form of an announcement.