Sorry, I haven't had time to test this last change in PostgreSQL yet. I wanted to get the change into the tree for Oracle while I was sitting there staring at it.
I'll clean up the PG version ASAP.
BTW this bug has been lurking in the ACS since the client property stuff was introduced in one of the ACS 3 versions. Ugh. It explains some of the sporadic and random-seeming bugs in this area folks have reported occassionally. There may be similar errors elsewhere in the security token handling, I haven't had time to look further.
Fortunately the bug could be triggered reliably by pages which contain frames, as the browser then fires off two parallel requests that end up entering that code simultaneously, triggering the race condition.
