Bug 959400 - [Notes] oAuth session forgery - second fix