Fixes against session tampering