What do you expect me to comment on this? The change is the same change that i've commited 6 days ago to the code repository of OpenACS [1] noted in the posting nr 6 in this thread [2], posted 5 minutes before the posting of Klaus.
The question is rather, AppScan should stop complaining about using the same session id after the privilege change
-gn
[1] http://cvs.openacs.org/changelog/OpenACS?cs=oacs-5-8%3Agustafn%3A20140725233311
[2] https://openacs.org/forums/message-view?message_id=4169882
