Fixed cookie vulnerability as reported in CVE-2013-5107
Merge remote-tracking branch 'upstream/master'