I was just looking at that.  I think that might do it. 

On Jun 5, 2014, at 4:07 PM, Geoff Goehle <notifications@github.com> wrote:

> In webwork3/lib/Routes/Authentication.pm:
> 
> >  	if(! defined(session 'key') && defined(session 'user')){
> >  		my $key = vars ->{db}->getKey(session 'user');
> > +		if(! defined($key)){
> > +			$key = vars->{db}->newKey();
> Maybe the issue is with newKey? In Authen.pm it calls newKey like this
> 
> $Key = $db->newKey(user_id=>$userID, key=>$newKey, timestamp=>$timestamp);
> In particular the $newKey variable is made with
> 
> my $newKey = $self->create_session($userID);
> and doesn't seem to come for free from the db call.
> 
> —
> Reply to this email directly or view it on GitHub.
>