Note that the Rails session security issue is being discussed on GitHub: https://github.com/rails/rails/issues/12881