MemCacheStore allows for arbitrary client generated session_ids?

I think it's definitely something to worry about. We had legitimate issues as a result of this behavior. But, since the core team stance (per #571) seems to be that it's not a problem, we just patched it locally. I guess if you think it's unlikely that a user could ever guess another's session ID or that two users modifying their session IDs would ever pick the same one, then it's probably not an issue. But, we saw otherwise.

This issue has been automatically marked as stale because it has not been commented on for at least three months.

The resources of the Rails core team are limited, and so we are asking for your help. If you can still reproduce this error on the 3-0-stable branch or on master, please reply with all of the information you have about it and add "[state:open]" to your comment. This will reopen the ticket for review. Likewise, if you feel that this is a very important feature for Rails to include, please reply with your explanation so we can consider it.

Thank you for all your contributions, and we hope you will understand this step to focus our efforts where they are most helpful.

oops forgot: [state:open]