[urgent fix][issue #160] close cookie login vulnerability
Merge remote-tracking branch 'origin/develop' into develop