Security: reset_session doesn't work under some conditions (session fixation possible)

Hello,

As Rails 2.3 is not stable yet I think it won't hurt anyone if I publish this security related bug as a public ticket.

This bug is similiar to #1601 reset_session Doesn't Result In New Session Id Being Applied Via Set-Cookie.

Using ActiveRecord session store and setting session variables after invoking reset_session causes session id to not change. It is common to reset session, and then set authentication related variables in session to prevent session fixation. Under ActiveRecord store this attack is not prevented.

Example controller code:

  def authenticate
    session[:lazy_load_to_get_id]
    old_session_id = request.session_options[:id]
    reset_session # standard way to prevent session fixation
    session[:old_session_id] = old_session_id
    redirect_to :action => 'privileged_action'
  end

  def privileged_action
    if session[:old_session_id] == request.session_options[:id]
      render :text => 'Hey, session fixation is possible!'
    else
      render :text => 'Looks ok'
    end
  end

CookieStore handles this scenario correctly.

Tested on 2.3-rc2 and edge rails (revision 9b8cde41bc84466bf60fc4de6af54dbeb11cc0d6).