And Rails 4. The difference with Rails 4 is that the session is encrypted as well as HMAC'd, but it's still the case that as along as you have the token (or can otherwise craft a session) you're hosed.